# Likewise, all the methods added will be available for all controllers.
class ApplicationController < ActionController::Base
+ def authorize_web
+ @user = User.find_by_token(session[:token])
+ end
-
- # HTTP AUTH stuff for the API
-
- def authorize(realm='Web Password', errormessage="Could't authenticate you")
- username, passwd = get_auth_data
- # check if authorized
- # try to get user
- if @user = User.authenticate(username, passwd)
+ def authorize(realm='Web Password', errormessage="Could't authenticate you") \r
+ username, passwd = get_auth_data # parse from headers\r
+ # authenticate per-scheme
+ if username.nil?\r
+ @user = nil # no authentication provided - perhaps first connect (client should retry after 401)\r
+ elsif username == 'token' \r
+ @user = User.authenticate_token(passwd) # preferred - random token for user from db, passed in basic auth\r
+ else\r
+ @user = User.authenticate(username, passwd) # basic auth\r
+ end\r
+ \r
+ # handle authenticate pass/fail\r
+ if @user
# user exists and password is correct ... horray!
- if @user.methods.include? 'lastlogin'
- # note last login
+ if @user.methods.include? 'lastlogin' # note last login
@session['lastlogin'] = user.lastlogin
@user.last.login = Time.now
@user.save()
@session["User.id"] = @user.id
end
else
- # the user does not exist or the password was wrong
- @response.headers["Status"] = "Unauthorized"
- @response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
- render_text(errormessage, 401)
+ # no auth, the user does not exist or the password was wrong
+ response.headers["Status"] = "Unauthorized"
+ response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
+ render_text(errormessage, 401) # :unauthorized
end
end
+ def get_xml_doc
+ doc = XML::Document.new
+ doc.encoding = 'UTF-8'
+ root = XML::Node.new 'osm'
+ root['version'] = API_VERSION
+ root['generator'] = 'OpenStreetMap server'
+ doc.root = root
+ return doc
+ end
+
+ # extract authorisation credentials from headers, returns user = nil if none\r
private
def get_auth_data
- user, pass = '', ''
- # extract authorisation credentials
- if request.env.has_key? 'X-HTTP_AUTHORIZATION'
- # try to get it where mod_rewrite might have put it
- authdata = @request.env['X-HTTP_AUTHORIZATION'].to_s.split
- elsif request.env.has_key? 'HTTP_AUTHORIZATION'
- # this is the regular location
- authdata = @request.env['HTTP_AUTHORIZATION'].to_s.split
+ if request.env.has_key? 'X-HTTP_AUTHORIZATION' # where mod_rewrite might have put it
+ authdata = request.env['X-HTTP_AUTHORIZATION'].to_s.split
+ elsif request.env.has_key? 'HTTP_AUTHORIZATION' # regular location
+ authdata = request.env['HTTP_AUTHORIZATION'].to_s.split
end
-
- # at the moment we only support basic authentication
+ # only basic authentication supported
if authdata and authdata[0] == 'Basic'
user, pass = Base64.decode64(authdata[1]).split(':')[0..1]
- end
+ end \r
return [user, pass]
end